US investigators have dissented over findings of an Ethiopian inquiry into the fatal Boeing 737 Max 8 crash outside Addis Ababa nearly four years ago, arguing that the conclusions focus on technical design issues and fail to take sufficient account of human factors and inadequate pilot responses to the loss of control.
The accident, involving Ethiopian Airlines flight ET302 in March 2019, was the second to involve a 737 Max in less than five months and led to a worldwide grounding of the type, over concerns that failure of a single angle-of-attack sensor could generate false air data and lead the horizontal stabiliser trimming system to push the aircraft into a rapid descent.
Ethiopia’s aircraft accident investigation bureau has concluded that the trimming system, known as MCAS, was responsible for the crash, echoing the Indonesian Lion Air 737 Max accident in October 2018.
It claims that a defective angle-of-attack sensor exposed the vulnerability of MCAS, which would have otherwise remained as a “hidden threat”.
The US National Transportation Safety Board fully concurs that the MCAS behaviour was part of the accident sequence.
But it disagrees that the angle-of-attack sensor was defective, arguing instead that a bird-strike on the instrument, causing its vane to break away, was more likely.
Crucially it also contests the Ethiopian inquiry’s suggestion that the aircraft was “unrecoverable” by the crew.
“We believe that the probable cause also needs to acknowledge that appropriate crew management of the event, per the procedures that existed at the time, would have allowed the crew to recover the airplane even when faced with the uncommanded nose-down inputs,” says the NTSB.
It has separately published its dissention over the draft report after it was not attached to the final report newly issued by the Ethiopian bureau.
The Ethiopian inquiry found that the aircraft’s throttle levers remained at take-off thrust, and that the stick-shaker activated as the jet became airborne from Addis Ababa.
Its captain attempted to engage the autopilot, despite this being inconsistent with stick-shaker procedures, but the crew “did not discuss any issue” relating to the stick-shaker, it states. The autopilot activated at the third attempt.
According to the inquiry the false angle-of-attack sensor data led to incorrect calculation of a minimum operational airspeed – which exceeded the maximum operational airspeed of 340kt – and also prevented the flight-management computer from detecting a threshold altitude at which thrust would have automatically reduced.
As the aircraft climbed, the crew retracted the flaps, but shortly afterwards the autopilot disconnected. The combination of manual flight, retracted flaps, and the false angle-of-attack data triggered MCAS to adjust the horizontal stabiliser and lower the nose.
Although the crew attempted to counter this nose-down tendency with manual input, the continuing high-thrust acceleration meant the pilots had to apply excessive forces in response.
MCAS triggered for a second time, and the pilots responded by activating the trim cut-out switches – a correct response, advised after the Lion Air accident – which effectively prevented MCAS from adjusting the stabiliser when it triggered for a third time.
At this point the aircraft was travelling at 332kt, at 9,100ft altitude, and gradually climbing but the crew was having to counter the out-of-trim stabiliser with substantial force.
The crew advised air traffic control of the flight-control difficulties, and aimed to reach the minimum safe altitude of 14,000ft in order to start diagnosing the problems.
But the “unbearable” manual forces needed to trim the aircraft and maintain the climb were too much for the pilots, and the captain called, “Put them up” – an apparent command to disconnect the trim cut-out switches which, critically, would also re-activate MCAS.
“It most likely appears that the flight crew were trying to find other means to relieve the force,” says the inquiry, in an explanation for the decision. MCAS subsequently commanded a fourth nose-down shift in the stabiliser, pushing the aircraft into its final fatal dive.
The inquiry says MCAS and a lack of pilot training “did not trigger” the accident, but that it was initiated by flawed data from the angle-of-attack sensor.
But the NTSB believes the analysis of the pilots’ performance is “not sufficiently developed” by the inquiry which, it adds, focuses “heavily” on system design issues instead.
“Absence of flight crew performance information limits the opportunity to address broader and equally important safety issues,” it states, pointing out that evaluation of the crew’s actions “would not have been particularly difficult” given the amount of information available.
“Design mitigation must adequately account for expected human behaviour [in order] to be successful,” the NTSB adds, and demands a “thorough understanding” of crew performance – not only for design purposes but also operational and training safety improvements.
The NTSB disputes a conclusion that airspeed and altitude ‘disagree’ messages were not presented to the crew, and says the inquiry should have explored the pilots’ “lack of conversation or action” in response to the messages.
According to the NTSB, the aircraft was not uncontrollable, but the inquiry neglects to state that a manual reduction of thrust and appropriate use of manual electric trim would have allowed the pilots to maintain control despite the uncommanded MCAS inputs.
“The flight crew’s failure to reduce thrust manually and the excessive airspeed that resulted played a significant role in the accident sequence of events,” the NTSB insists.
It says the activation of the stick-shaker or the annunciation of an ‘airspeed disagree’ message should have prompted an “expected” crew response to disengage the autothrottle.
Instead the autothrottle remained active and responsive to the erroneous angle-of-attack data, and failed to order a thrust reduction. Despite an aural ‘overspeed’ warning as the aircraft accelerated towards 340kt, at high thrust, the NTSB says the crew did not notice the autothrottle’s unusual behaviour, or take action to manually control thrust, leaving the pilots to deal with excessive forces on the control column and manual trim-wheel.
Countering the uncommanded nose-down inputs with manual nose-up electric trim – as described in operating manual documentation – would have enabled control forces to remain in a “controllable regime”, it says.
It adds that the draft report “did not examine” the pilots’ understanding of the relationship between airspeed and necessary control forces, and says it “misses and opportunity” to evaluate the effectiveness of airline training on this matter.
Evidence from the inquiry, the NTSB states, shows the crew did not carry out appropriate non-normal procedures in response to annunciations relating to unreliable airspeed, stall warning and runaway stabiliser.
Flight-data recorder information shows only “minimal” use of manual electric trim, which would have reduced control forces, while performing memory items for unreliable airspeed or runaway stabiliser would have led the crew to disengage the autothrottle. Such actions should have been carried out before the crew activated the trim cut-out switches.
But even after activating the trim cut-out, says the NTSB, the crew subsequently disconnected the switches – a decision which was “contrary” to procedures which directed crews to ensure that the cut-out remained in place for the rest of the flight.
“Available evidence for this accident did not indicate why the crew performed this action,” it adds.
“By not evaluating the human factors associated with this crew action, the report provides a limited understanding of the circumstances leading to the airplane’s nose-down pitch before impact.”
